Account Security

Hi,

In Active Directory is there any way to disable a user if
the user don't use his user account for 60 days and also
delete the same user if day become 120 days.

For Information
Server: Windows 2000 Server + SP4
Clients:Windows 2000 Professional + SP4

Regards,

Tayfun Keresteci

Dave
Wed Dec 03 04:50:51 CST 2003

Tayfun
you can run a query using dsquery and pipe it to dsmod to search for and
disable accounts not used for x days. I don't think you can use this to
delete accounts.

syntax is something like dsquery user -inactive 9 (weeks) | dsmod
user -disabled yes

you'll have to test the syntax

Dave

"Tayfun Keresteci" <tkeresteci@hotmail.com> wrote in message
news:bca201c3b96c$e127e300$a601280a@phx.gbl...
> Hi,
>
> In Active Directory is there any way to disable a user if
> the user don't use his user account for 60 days and also
> delete the same user if day become 120 days.
>
> For Information
> Server: Windows 2000 Server + SP4
> Clients:Windows 2000 Professional + SP4
>
> Regards,
>
> Tayfun Keresteci

Jose
Wed Dec 03 10:11:39 CST 2003

You can set an account expire date..& account will be removed, don't know if
you can check if used then delete automatically

Jose

"Dave" <dave@wellesley13.freeserve.co.uk> wrote in message
news:uWcLTtYuDHA.2712@TK2MSFTNGP11.phx.gbl...
> Tayfun
> you can run a query using dsquery and pipe it to dsmod to search for and
> disable accounts not used for x days. I don't think you can use this to
> delete accounts.
>
> syntax is something like dsquery user -inactive 9 (weeks) | dsmod
> user -disabled yes
>
> you'll have to test the syntax
>
> Dave
>
> "Tayfun Keresteci" <tkeresteci@hotmail.com> wrote in message
> news:bca201c3b96c$e127e300$a601280a@phx.gbl...
> > Hi,
> >
> > In Active Directory is there any way to disable a user if
> > the user don't use his user account for 60 days and also
> > delete the same user if day become 120 days.
> >
> > For Information
> > Server: Windows 2000 Server + SP4
> > Clients:Windows 2000 Professional + SP4
> >
> > Regards,
> >
> > Tayfun Keresteci
>
>

MCSE
Wed Dec 03 10:58:15 CST 2003

Using the tools only supplied with Windows, no not automatically. Your best
bet is to script it as Dave pointed out....however these are all Windows
Server 2003 tools that he mentions.


Best,
Will
www.mcseworld.com


"Tayfun Keresteci" <tkeresteci@hotmail.com> wrote in message
news:bca201c3b96c$e127e300$a601280a@phx.gbl...
> Hi,
>
> In Active Directory is there any way to disable a user if
> the user don't use his user account for 60 days and also
> delete the same user if day become 120 days.
>
> For Information
> Server: Windows 2000 Server + SP4
> Clients:Windows 2000 Professional + SP4
>
> Regards,
>
> Tayfun Keresteci

Dave
Wed Dec 03 11:02:33 CST 2003

An expired account isn't deleted.

"Jose" <lojic28@hotmail.com> wrote in message
news:e$3BUdbuDHA.2360@TK2MSFTNGP10.phx.gbl...
> You can set an account expire date..& account will be removed, don't know
if
> you can check if used then delete automatically
>
> Jose
>
> "Dave" <dave@wellesley13.freeserve.co.uk> wrote in message
> news:uWcLTtYuDHA.2712@TK2MSFTNGP11.phx.gbl...
> > Tayfun
> > you can run a query using dsquery and pipe it to dsmod to search for and
> > disable accounts not used for x days. I don't think you can use this to
> > delete accounts.
> >
> > syntax is something like dsquery user -inactive 9 (weeks) | dsmod
> > user -disabled yes
> >
> > you'll have to test the syntax
> >
> > Dave
> >
> > "Tayfun Keresteci" <tkeresteci@hotmail.com> wrote in message
> > news:bca201c3b96c$e127e300$a601280a@phx.gbl...
> > > Hi,
> > >
> > > In Active Directory is there any way to disable a user if
> > > the user don't use his user account for 60 days and also
> > > delete the same user if day become 120 days.
> > >
> > > For Information
> > > Server: Windows 2000 Server + SP4
> > > Clients:Windows 2000 Professional + SP4
> > >
> > > Regards,
> > >
> > > Tayfun Keresteci
> >
> >
>
>

Grog
Wed Dec 03 15:59:51 CST 2003

There's no automagic way to do this that I know of. I used the below script
and tweaked it to output to a file and hardcoded my domain name in. The
outputted text file is loaded into Excel and sorted. Then I manually
disabled stale ID's.

http://www.myitforum.com/articles/11/view.asp?id=2960

Grog

"Tayfun Keresteci" <tkeresteci@hotmail.com> wrote in message
news:bca201c3b96c$e127e300$a601280a@phx.gbl...
> Hi,
>
> In Active Directory is there any way to disable a user if
> the user don't use his user account for 60 days and also
> delete the same user if day become 120 days.
>
> For Information
> Server: Windows 2000 Server + SP4
> Clients:Windows 2000 Professional + SP4
>
> Regards,
>
> Tayfun Keresteci